Cybersecurity & AppSec Track

S1 · SAST/DAST & Container Scans

1. SAST / DAST & Container Vulnerability Scanner

Simulate Trivy container image scans, Snyk SAST code analysis, and OWASP ZAP DAST web inspection. Identify CVEs, misconfigurations, and dependency risks before they reach production.

Scanner Controls

Select a scanner engine and target to begin vulnerability analysis.

Scanner Engine:

Scan Target / Image / Repo:

Critical CVEs

2

Immediate Patch Required

High Severity

3

Fix within 7 days

Medium Severity

2

Scheduled Maintenance

Low / Info

1

Best practice hardening

Detected Vulnerabilities (8)

CVE / ID	Severity	Scanner	Component	CVSS
CVE-2024-21626	CRITICAL	Trivy	runc	10.0
CVE-2023-44487	HIGH	Trivy	nghttp2 / envoy	7.5
SNYK-JS-EXPRESS-594238	HIGH	Snyk Code	src/api/auth.ts:42	8.6
CVE-2024-3094	CRITICAL	Trivy	liblzma5	10.0
ZAP-2026-001	MEDIUM	OWASP ZAP	HTTPS Response Header	5.3
SNYK-JS-LODASH-567746	MEDIUM	Snyk Code	lodash	6.5
CVE-2023-38545	HIGH	Trivy	libcurl4	8.1
ZAP-2026-002	LOW	OWASP ZAP	/search?q=	3.8

🔬 Vulnerability Details & Fix

CVE-2024-21626 (Trivy)

Leaky Vessels Container Breakout in runc

Affected:

v1.1.11

Remediated:

v1.1.12

Description:

File descriptor leak in runc allows container process to access host filesystem and escape container boundary.

🛠️ Remediation Fix Snippet:

Upgrade base container image OS packages or update runc to >= 1.1.12 via Dockerfile / k8s node image.

S2 · OWASP Top 10 Matrix

OWASP Top 10 Vulnerability Matrix & Remediation Lab

Select any OWASP Top 10 category to view real-world exploit scenarios, compare vulnerable vs remediated code, and run interactive exploit tests.

A01:2021

Broken Access Control

Impact: Data exfiltration, vertical/horizontal privilege escalation, unauthorized API access.

Failures allow unauthorized users to view, edit, or delete data belonging to other users (IDOR, privilege escalation).

❌ Vulnerable ImplementationUNSECURE

// VULNERABLE: Trusting user-supplied ID parameter directly
app.get('/api/invoice/:id', async (req, res) => {
  const invoice = await db.query('SELECT * FROM invoices WHERE id = ' + req.params.id);
  res.json(invoice); // No authorization check!
});

✅ Remediated Secure ImplementationHARDENED

// SECURE: Enforce authorization against authenticated session
app.get('/api/invoice/:id', authMiddleware, async (req, res) => {
  const invoice = await db.query(
    'SELECT * FROM invoices WHERE id = $1 AND owner_id = $2',
    [req.params.id, req.user.id]
  );
  if (!invoice) return res.status(403).json({ error: 'Forbidden' });
  res.json(invoice);
});

🛡️ Key Architectural Defenses:

•Enforce RBAC/ABAC at domain model layer
•Deny access by default (Principle of Least Privilege)
•Log access control failures and alert on repeated violations

🧪 Exploit / Defense Interactive Tester

Test Request Payload:

Target Handler Mode:

S3 · Secrets & Vault Flow

3. Secret Management Workflow (HashiCorp Vault vs AWS Secrets Manager)

Compare enterprise secret engine architecture, dynamic credential generation, token TTL leases, and automated rotation.

🔐

HashiCorp Vault

MULTI-CLOUD / ON-PREM

•Encryption: Shamir Secret Sharing, Transit Secrets Engine (EaaS).
•Dynamic Secrets: Generates short-lived DB credentials (e.g. 1h TTL) on-demand.
•Auth Methods: AppRole, Kubernetes ServiceAccount JWT, TLS Certificates.

☁️

AWS Secrets Manager

AWS NATIVE

•Encryption: Envelope Encryption integrated with AWS KMS keys.
•Automated Rotation: Native AWS Lambda rotation templates for RDS, Redshift, DocumentDB.
•Auth Methods: IAM Policies, STS Temporary Credentials, VPC Endpoints.

Secret Lifecycle Pipeline

Storage & KMS Encryption: Secrets are encrypted using AES-256-GCM. In Vault, master keys are unsealed via Shamir threshold key shares. In AWS, KMS Envelope Encryption wraps data keys.

💻 Secret Fetch & Rotation Simulator

Select Provider:

Secret Identifier Path:

Lease TTL: 3600s remaining

S4 · WAF & TLS Hardening

Web Application Firewall (WAF) & SSL/TLS Hardening Lab

Configure L7 WAF protection rulesets, test attack payloads, and audit SSL/TLS cipher suites & security response headers.

WAF Rule Table (4 Active Rules)

Rule Name	Type	Action	Blocked Hits
OWASP Core Rule Set - SQL Injection	SQLi	BLOCK	1420
OWASP Core Rule Set - Cross Site Scripting (XSS)	XSS	BLOCK	890
Rate Limit: Max 100 Reqs / 5 Min	RateLimit	BLOCK	310
Geo-IP Filter: Block Tor Exit Nodes	GeoBlock	CAPTCHA	145

📡 WAF Live Traffic Tester

Select Traffic Profile:

SSL/TLS Protocol Hardening & Response Header Audit

Configure SSL Labs target grading settings and test header compliance.

SSL Rating:Grade A+

TLS Protocols & Ciphers:

Enable TLS 1.3 (Modern, Perfect Forward Secrecy)Enable TLS 1.2Enable Weak Ciphers (RC4, 3DES, CBC) - ⚠️ INSECURE

HTTP Security Headers:

Strict-Transport-Security (HSTS max-age=31536000)Content-Security-Policy (CSP default-src 'self')X-Frame-Options (DENY Clickjacking)

Audit Evaluation Result: Optimal TLS 1.3 & Security Headers Hardening!

S5 · STRIDE Threat Modeling

Threat model canvas

Select an architecture asset, apply mitigations, and compare the remaining STRIDE risk. Findings are deterministic so each control change is easy to inspect.

Architecture asset

Public request and application boundary

Applied mitigations

Least PrivilegeAddresses Elevation of privilege.Strong AuthenticationAddresses Spoofing.Input ValidationAddresses Tampering.Object AuthorizationAddresses Information disclosure.Rate LimitingAddresses Denial of service.Audit LoggingAddresses Repudiation.

Web API findings

STRIDE threats ordered by severity.

Residual riskHigh

Risk score18 / 18

Open findings6

High or critical remaining5

Elevation of privilege

criticalOpen

A compromised endpoint may grant actions beyond the caller role.

Control: Least Privilege

Spoofing

highOpen

An attacker may impersonate a caller when identity checks are weak.

Control: Strong Authentication

Tampering

highOpen

Untrusted request data can alter application state.

Control: Input Validation

Information disclosure

highOpen

Overly broad responses can expose data to unauthorized callers.

Control: Object Authorization

Denial of service

highOpen

Unbounded requests can exhaust API capacity.

Control: Rate Limiting

Repudiation

mediumOpen

Without an audit trail, actions cannot be reliably attributed.

Control: Audit Logging

S6 · IAM, RBAC & Least Privilege

IAM policy evaluator

Build an access request and evaluate it against a local policy set. Explicit Deny rules, wildcard matching, and MFA conditions are handled by the shared evaluator.

Local policy set

Deny rules are evaluated before matching Allow rules.

6 rules

IAM policy rules used by the evaluator
Effect	Principal	Action	Resource	Condition
Deny	user/*	orders:Delete	orders/*	—
Allow	role/api-reader	orders:Get	orders/*	—
Allow	role/api-reader	orders:List	orders/*	—
Allow	role/ops-admin	admin:*	admin/*	MFA required
Allow	service/orders-worker	orders:Update	orders/prod	—
Allow	role/ops-admin	orders:*	orders/*	MFA required

S7 · API SECURITY

Layered API request lab

Test the controls that protect an API boundary: identity, object ownership, schema validation, and endpoint rate limits. The shared evaluator returns the first control that needs attention.

Safe example request

This illustrative request is display-only. The lab never executes entered payload text or sends network traffic.

DISPLAY ONLY

GET /v1/orders/order_2048
Authorization: Bearer <short-lived-token>

IdentityVerified

PayloadSchema-valid

TrafficWithin limit

S8 · ZERO TRUST

Zero Trust policy path

Model a request using identity, device posture, source zone, destination zone, MFA, and action. The policy engine evaluates every request instead of trusting the network location alone.

Request path visualization

Static policy stages make the trust boundary explicit before any decision is applied.

Source zoneWorkforceRequest origin

Policy engineEvaluate signalsVerify every signal

Destination zoneDataProtected resource

Current pathworkforce → data · read

Every hop is evaluated with the same signals; being on a workforce or workload network does not grant implicit access.

S9 · Incident Response & SOC Triage

Seeded alert investigation

Practice a repeatable incident lifecycle against safe, synthetic alerts. Classify the signal, preserve evidence, contain affected assets, and score response readiness with the shared evaluator.

Alert scenario

Credential stuffing burst

Identity gateway

A concentrated authentication failure pattern is targeting several customer accounts from rotating source addresses.

•78 failed sign-ins in 10 minutes
•12 accounts targeted
•No successful privileged login observed

Severity classification

CriticalMaterial impact or active compromise of critical services.HighLikely compromise or significant business impact.MediumContained impact requiring coordinated response.LowLimited impact with no evidence of material compromise.

Affected asset count2

0 assets10 assets

Containment completeAffected assets are isolated without destroying evidence.Forensic evidence preservedCapture logs, volatile context, and chain-of-custody details before eradication.

Incident lifecycle

01PreparationConfirm playbook, roles, and communication channel.02IdentifyValidate the alert and define incident scope.03ContainLimit spread while preserving the investigation.04EradicateRemove persistence and the underlying cause.05RecoverRestore trusted service and monitor closely.06Lessons learnedDocument findings and preventive improvements.

Complete the controls, then score the response to see priority and the evaluator’s next action.

SOC handoff checklist

• Keep alert notes factual and timestamped.
• Preserve evidence before removing persistence.
• Escalate based on business impact, not signal volume alone.

S10 · SIEM Detection & Log Analysis

Event filtering and detection rules

Query deterministic authentication, API, WAF, and cloud audit events. Filters narrow analyst scope; the shared evaluator determines which events match the selected detection rule.

Detection rule

Find events with five or more failed attempts.

Source filter

Severity filter

Structured event stream

Synthetic events only; source addresses use documentation ranges.

8 of 8 events

Synthetic SIEM events filtered by source and severity
Event ID	Source	Severity	Kind / summary	User	Failed	Privilege	Bytes out
auth-001	authentication	high	login-failureRepeated sign-in failures for one account	alex	8	—	—
auth-002	authentication	low	login-successSuccessful sign-in after one retry	morgan	1	—	—
api-014	api	low	token-refreshRoutine service token refresh	service-orders	—	—	0.0 MB
api-033	api	critical	bulk-exportLarge response volume from customer export endpoint	jordan	—	—	1.85 MB
waf-009	waf	medium	blocked-requestBurst of rejected authentication-shaped requests	anonymous	6	—	—
waf-010	waf	low	blocked-requestSingle malformed request blocked at edge	anonymous	2	—	—
cloud-021	cloud-audit	high	role-changeProduction role granted outside maintenance window	sam	—	Yes	—
cloud-022	cloud-audit	low	policy-readRead-only policy inspection	auditor	—	—	0.0 MB

Choose a rule and optional filters, then run detection to see evaluator-matched event IDs and the analyst conclusion.

S11 · Software Supply Chain

Dependency and SBOM analyzer

Inspect package provenance, vulnerability severity, immutable versions, signatures, and license policy before an artifact enters the release pipeline.

Package inventory

The evaluator re-checks every row whenever the license policy changes.

5 packages

Software bill of materials package inventory
Package	Version	Severity	Provenance	License
express	4.19.2	high	Signed	MIT
lodash	4.17.21	medium	Signed	Apache-2.0
axios	^1.7.2(unpinned)	low	Signed	MIT
internal-plugin	2.1.0	none	Unsigned	Apache-2.0
legacy-parser	1.4.0	none	Signed	GPL-3.0

License allowlist

Only selected SPDX licenses may ship. Toggle a license to re-run the SBOM policy.

MITApache-2.0BSD-3-ClauseISC

Release policyBlock

BLOCK

6 findings require attention before release.

Evaluator findings

express has a high vulnerability.
lodash has a medium vulnerability.
axios has a low vulnerability.
axios is not pinned to an immutable version.
internal-plugin is not signed.
legacy-parser uses disallowed license GPL-3.0.

Allowlist currently contains 2 of 3 licenses seen in the inventory.

S12 · Container Security

Container admission simulator

Toggle workload controls to model a Kubernetes admission decision. The shared evaluator rejects unsafe privileges, host access, unsigned images, and unconstrained resources.

Pod security controls

Enable each control that is enforced by your workload policy. Host access controls are secure when their toggles remain off.

Run as non-root userThe workload uses an unprivileged UID instead of root.Read-only root filesystemThe image root filesystem cannot be modified at runtime.Drop Linux capabilitiesUnneeded kernel capabilities are removed from the container.Use host networkingDisabled means the pod remains isolated from the node network namespace.Mount host pathsDisabled means the workload cannot mount arbitrary node filesystem paths.Require a signed imageThe registry signature is verified before the image is admitted.Set CPU and memory limitsThe workload has resource requests or limits to prevent noisy neighbors.

Admission decisionRejected

DENY

6 controls failed and must be remediated.

Failed controls

Container must run as a non-root user.
Remediation: Set a pod or image securityContext with runAsNonRoot: true and a non-zero runAsUser.
Container root filesystem must be read-only.
Remediation: Set securityContext.readOnlyRootFilesystem: true and mount explicit writable volumes where needed.
Host networking is not permitted.
Remediation: Remove hostNetwork: true and expose the service through a cluster Service or ingress.
Host path mounts are not permitted.
Remediation: Remove hostPath volumes and use an approved persistent volume or projected secret instead.
Image signature verification is required.
Remediation: Sign the image in CI and configure admission policy to verify its registry signature.
CPU and memory limits are required.
Remediation: Declare CPU and memory requests and limits in the workload specification.

Controls passing1

Controls failed6

Policy modeStrict admission

S13 · CLOUD SECURITY POSTURE

13. Cloud Security Posture Scanner

Review a local AWS account snapshot across identity, storage, network, logging, key management, and firewall controls. Findings are educational examples, not a live cloud scan.

Posture score

0

Grade F

Open findings

7

Evaluator-calculated risk

Resolved findings

0

Marked fixed locally

Last recalculation

Not run yet

AWS findings (7)

Select a finding to inspect evidence and remediation.

Cloud security posture findings
Control	Finding	Severity
IAM	arn:aws:iam::000000000000:root	critical
S3	s3://acme-prod-invoices	high
VPC	vpc-0f42a1e9 / subnet-07b3c4d1	medium
CloudTrail	arn:aws:cloudtrail:us-east-1:000000000000:trail/example-audit	high
KMS	key/7e6d0d5c-4dcb-4ae5-9a19-prod-data	medium
Security groups	sg-0a8d66bd / prod-postgres	critical
IAM	user/example-deploy / EXAMPLE_KEY_ID	low

S14 · PRIVACY & DATA CONTROLS

14. Data Classification & Privacy Controls

Classify example fields, inspect the protection controls mapped to each class, and complete a practical privacy readiness checklist.

Educational guidance only: this exercise is not formal legal compliance advice and does not determine obligations under any specific privacy law or contract.

Example data inventory

Choose a field, then classify it according to its sensitivity and use.

Example fields and data classifications
Field	Example value	Classification
Link activity to a customer account	acct_7F29D1	internal
Send account notifications	alex@example.test	confidential
Reference a vaulted payment method	tok_visa_••••4242	restricted
Display a catalog item	Network Fundamentals	public

Classify email_address

publicinternalconfidentialrestricted

Privacy readiness checklist

Use the checklist to turn classification into operating controls.

0/5 complete

Record the data inventoryName fields, sources, owners, and systems of record.Document purpose and lawful basisTie collection and processing to a documented business purpose.Review access and sharingConfirm least privilege, approved processors, and transfer boundaries.Set retention and deletion evidenceDefine the schedule and retain proof that deletion occurred.Exercise the privacy incident pathIdentify escalation owners and notification decision points.

Application Security & Vulnerability Management

1. SAST / DAST & Container Vulnerability Scanner

Scanner Controls

Detected Vulnerabilities (8)

🔬 Vulnerability Details & Fix

Leaky Vessels Container Breakout in runc

OWASP Top 10 Vulnerability Matrix & Remediation Lab

Broken Access Control

🛡️ Key Architectural Defenses:

🧪 Exploit / Defense Interactive Tester

3. Secret Management Workflow (HashiCorp Vault vs AWS Secrets Manager)

HashiCorp Vault

AWS Secrets Manager

Secret Lifecycle Pipeline

💻 Secret Fetch & Rotation Simulator

Web Application Firewall (WAF) & SSL/TLS Hardening Lab

WAF Rule Table (4 Active Rules)

📡 WAF Live Traffic Tester

SSL/TLS Protocol Hardening & Response Header Audit

TLS Protocols & Ciphers:

HTTP Security Headers:

Threat model canvas

Web API findings

Elevation of privilege

Spoofing

Tampering

Information disclosure

Denial of service

Repudiation

IAM policy evaluator

Local policy set

Layered API request lab

Safe example request

Zero Trust policy path

Request path visualization

Seeded alert investigation

Credential stuffing burst

Event filtering and detection rules

Structured event stream

Dependency and SBOM analyzer

Package inventory

Evaluator findings

Container admission simulator

Failed controls

13. Cloud Security Posture Scanner

AWS findings (7)

14. Data Classification & Privacy Controls

Example data inventory

Privacy readiness checklist